# CVEs published 2020-01-06

63 CVEs were published on January 6, 2020: 3 critical, 10 high. Days are UTC.

- [CVE-2018-7794](https://cve.now/CVE-2018-7794.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon (CVSS 7.5, Schneider Electric SE Modicon M580, Modicon M340, Modicon Q…)
- [CVE-2019-6857](https://cve.now/CVE-2019-6857.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon (CVSS 7.5, Schneider Electric SE Modicon M580, Modicon M340, Modicon Q…)
- [CVE-2019-6856](https://cve.now/CVE-2019-6856.md): A CWE-754: Improper Check for Unusual or Exceptional Conditions vulnerability exists in Modicon M580, Modicon M340, Modicon Quantum, Modicon (CVSS 7.5, Schneider Electric SE Modicon M580, Modicon M340, Modicon Q…)
- [CVE-2019-6855](https://cve.now/CVE-2019-6855.md): Incorrect Authorization vulnerability exists in EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), M (no CVSS, EcoStruxure Control Expert (all versions prior to 14.1 Hot…)
- [CVE-2019-6854](https://cve.now/CVE-2019-6854.md): A CWE-287: Improper Authentication vulnerability exists in a folder within EcoStruxure Geo SCADA Expert (ClearSCADA) -with initial releases (no CVSS, EcoStruxure Geo SCADA Expert (ClearSCADA) with initial rele…)
- [CVE-2014-8674](https://cve.now/CVE-2014-8674.md): Multiple Cross-Site Scripting (XSS) vulnerabilities exist in Simple Online Planning (SOPlanning) before 1.33 via the document.cookie in nb\_m (no CVSS)
- [CVE-2014-9405](https://cve.now/CVE-2014-9405.md): A Cross-Site Scripting (XSS) vulnerability exists in the description field of an Download RSS item or Contacts in Freebox OS Web interface 3 (no CVSS)
- [CVE-2015-4553](https://cve.now/CVE-2015-4553.md): A file upload issue exists in DeDeCMS before 5.7-sp1, which allows malicious users getshell. (no CVSS)
- [CVE-2015-5951](https://cve.now/CVE-2015-5951.md): A file upload issue exists in the specid parameter in Thomson Reuters FATCH before 5.2, which allows malicious users to upload arbitrary PHP (no CVSS)
- [CVE-2019-20348](https://cve.now/CVE-2019-20348.md): OKER G232V1 v1.03.02.20161129 devices provide a root terminal on a UART serial interface without proper access control. (no CVSS)
- [CVE-2019-18842](https://cve.now/CVE-2019-18842.md): A cross-site scripting (XSS) vulnerability in the configuration web interface of the Jinan USR IOT USR-WIFI232-S/T/G2/H Low Power WiFi Modul (no CVSS)
- [CVE-2020-5846](https://cve.now/CVE-2020-5846.md): An insecure file upload and code execution issue was discovered in Ahsay Cloud Backup Suite 8.3.0.30 via a "PUT /obs/obm7/file/upload" reque (no CVSS)
- [CVE-2019-18625](https://cve.now/CVE-2019-18625.md): An issue was discovered in Suricata 5.0.0. (no CVSS)
- [CVE-2019-16271](https://cve.now/CVE-2019-16271.md): DTEN D5 and D7 before 1.3.2 devices allows remote attackers to read saved whiteboard image PDF documents via storage/emulated/0/Notes/PDF on (no CVSS)
- [CVE-2019-16272](https://cve.now/CVE-2019-16272.md): On DTEN D5 and D7 before 1.3.4 devices, factory settings allows for firmware reflash and Android Debug Bridge (adb) enablement. (no CVSS)
- [CVE-2019-16273](https://cve.now/CVE-2019-16273.md): DTEN D5 and D7 before 1.3.4 devices allow unauthenticated root shell access through Android Debug Bridge (adb), leading to arbitrary code ex (no CVSS)
- [CVE-2019-16274](https://cve.now/CVE-2019-16274.md): DTEN D5 before 1.3 and D7 before 1.3 devices transfer customer data files via unencrypted HTTP. (no CVSS)
- [CVE-2019-16716](https://cve.now/CVE-2019-16716.md): OX App Suite through 7.10.2 has Incorrect Access Control. (no CVSS)
- [CVE-2014-3743](https://cve.now/CVE-2014-3743.md): Multiple cross-site scripting (XSS) vulnerabilities in the Marked module before 0.3.1 for Node.js allow remote attackers to inject arbitrary (no CVSS, marked)
- [CVE-2019-16717](https://cve.now/CVE-2019-16717.md): OX App Suite through 7.10.2 has XSS. (no CVSS)
- [CVE-2019-19509](https://cve.now/CVE-2019-19509.md): An issue was discovered in rConfig 3.9.3. (no CVSS)
- [CVE-2019-19585](https://cve.now/CVE-2019-19585.md): An issue was discovered in rConfig 3.9.3. (no CVSS)
- [CVE-2020-5512](https://cve.now/CVE-2020-5512.md): Gila CMS 1.11.8 allows /admin/media?path=../ Path Traversal. (no CVSS)
- [CVE-2020-5204](https://cve.now/CVE-2020-5204.md): Buffer overflow vulnerability in uftpd (CVSS 6.5, troglobit uftpd)
- [CVE-2020-5513](https://cve.now/CVE-2020-5513.md): Gila CMS 1.11.8 allows /cm/delete?t=../ Directory Traversal. (no CVSS)
- [CVE-2020-5514](https://cve.now/CVE-2020-5514.md): Gila CMS 1.11.8 allows Unrestricted Upload of a File with a Dangerous Type via .phar or .phtml to the lzld/thumb?src= URI. (no CVSS)
- [CVE-2015-4039](https://cve.now/CVE-2015-4039.md): Multiple cross-site scripting (XSS) vulnerabilities in the WP Membership plugin 1.2.3 for WordPress allow remote authenticated users to inje (no CVSS)
- [CVE-2020-5515](https://cve.now/CVE-2020-5515.md): Gila CMS 1.11.8 allows /admin/sql?query= SQL Injection. (no CVSS)
- [CVE-2019-18792](https://cve.now/CVE-2019-18792.md): An issue was discovered in Suricata 5.0.0. (no CVSS)
- [CVE-2019-9468](https://cve.now/CVE-2019-9468.md): In export\_key\_der of export\_key.cpp, there is possible memory corruption due to a double free. (no CVSS, Android)
- [CVE-2019-9469](https://cve.now/CVE-2019-9469.md): In km\_compute\_shared\_hmac of km4.c, there is a possible out of bounds write due to improper input validation. (no CVSS, Android)
- [CVE-2019-9470](https://cve.now/CVE-2019-9470.md): In dma\_sblk\_start of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-9471](https://cve.now/CVE-2019-9471.md): In set\_outbound\_iatu of abc-pcie.c, there is a possible out of bounds write due to a missing bounds check. (no CVSS, Android)
- [CVE-2019-9472](https://cve.now/CVE-2019-9472.md): In DCRYPTO\_equals of compare.c, there is a possible timing attack due to improperly used crypto. (no CVSS, Android)
- [CVE-2020-5840](https://cve.now/CVE-2020-5840.md): An issue was discovered in HashBrown CMS before 1.3.2. (no CVSS, hashbrown-cms)
- [CVE-2019-15602](https://cve.now/CVE-2019-15602.md): The fileview package v0.1.6 has inadequate output encoding and escaping, which leads to a stored Cross-Site Scripting (XSS) vulnerability in (no CVSS, fileview)
- [CVE-2019-15603](https://cve.now/CVE-2019-15603.md): The seefl package v0.1.1 is vulnerable to a stored Cross-Site Scripting (XSS) vulnerability via a malicious filename rendered in a directory (no CVSS, seeftl)
- [CVE-2016-11017](https://cve.now/CVE-2016-11017.md): The application login page in AKIPS Network Monitor 15.37 through 16.5 allows a remote unauthenticated attacker to execute arbitrary OS comm (no CVSS)
- [CVE-2019-20343](https://cve.now/CVE-2019-20343.md): The MojoHaus Exec Maven plugin 1.1.1 for Maven allows code execution via a crafted XML document because a configuration element (within a pl (no CVSS)
- [CVE-2020-5519](https://cve.now/CVE-2020-5519.md): The WebAdmin Console in OpenLiteSpeed before v1.6.5 does not strictly check request URLs, as demonstrated by the "Server Configuration \> Ext (no CVSS)
- [CVE-2019-15977](https://cve.now/CVE-2019-15977.md): Cisco Data Center Network Manager Authentication Bypass Vulnerabilities (CVSS 9.8, Cisco Data Center Network Manager)
- [CVE-2019-15978](https://cve.now/CVE-2019-15978.md): Cisco Data Center Network Manager Command Injection Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15979](https://cve.now/CVE-2019-15979.md): Cisco Data Center Network Manager Command Injection Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15980](https://cve.now/CVE-2019-15980.md): Cisco Data Center Network Manager Path Traversal Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15981](https://cve.now/CVE-2019-15981.md): Cisco Data Center Network Manager Path Traversal Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15982](https://cve.now/CVE-2019-15982.md): Cisco Data Center Network Manager Path Traversal Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15983](https://cve.now/CVE-2019-15983.md): Cisco Data Center Network Manager XML External Entity Read Access Vulnerability (CVSS 4.9, Cisco Data Center Network Manager)
- [CVE-2019-15984](https://cve.now/CVE-2019-15984.md): Cisco Data Center Network Manager SQL Injection Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15985](https://cve.now/CVE-2019-15985.md): Cisco Data Center Network Manager SQL Injection Vulnerabilities (CVSS 7.2, Cisco Data Center Network Manager)
- [CVE-2019-15999](https://cve.now/CVE-2019-15999.md): Cisco Data Center Network Manager JBoss EAP Unauthorized Access Vulnerability (CVSS 5.4, Cisco Data Center Network Manager)
- [CVE-2019-15975](https://cve.now/CVE-2019-15975.md): Cisco Data Center Network Manager Authentication Bypass Vulnerabilities (CVSS 9.8, Cisco Data Center Network Manager)
- [CVE-2019-15976](https://cve.now/CVE-2019-15976.md): Cisco Data Center Network Manager Authentication Bypass Vulnerabilities (CVSS 9.8, Cisco Data Center Network Manager)
- [CVE-2019-20354](https://cve.now/CVE-2019-20354.md): The web application component of piSignage before 2.6.4 allows a remote attacker (authenticated as a low-privilege user) to download arbitra (no CVSS)
- [CVE-2019-5988](https://cve.now/CVE-2019-5988.md): Stored cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers to (no CVSS, ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer)
- [CVE-2019-5989](https://cve.now/CVE-2019-5989.md): DOM-based cross-site scripting vulnerability in Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote attackers (no CVSS, ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer)
- [CVE-2019-5990](https://cve.now/CVE-2019-5990.md): Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allow remote attackers to obtain a login password via HTTP referer. (no CVSS, ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer)
- [CVE-2019-5987](https://cve.now/CVE-2019-5987.md): Access analysis CGI An-Analyzer released in 2019 June 24 and earlier allows remote authenticated attackers to execute arbitrary OS commands (no CVSS, ANGLERSNET Co,.Ltd. Access analysis CGI An-Analyzer)
- [CVE-2019-20352](https://cve.now/CVE-2019-20352.md): In Netwide Assembler (NASM) 2.15rc0, a heap-based buffer over-read occurs (via a crafted .asm file) in set\_text\_free when called from expand (no CVSS)
- [CVE-2020-5191](https://cve.now/CVE-2020-5191.md): PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple Persistent XSS vulnerabilities. (no CVSS)
- [CVE-2020-5192](https://cve.now/CVE-2020-5192.md): PHPGurukul Hospital Management System in PHP v4.0 suffers from multiple SQL injection vulnerabilities: multiple pages and parameters are not (no CVSS)
- [CVE-2019-19265](https://cve.now/CVE-2019-19265.md): IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 1 of 2) in notes for contacts. (no CVSS)
- [CVE-2019-19266](https://cve.now/CVE-2019-19266.md): IceWarp WebMail Server 12.2.0 and 12.1.x before 12.2.1.1 (and probably earlier versions) allows XSS (issue 2 of 2) in notes for objects. (no CVSS)
- [CVE-2019-18179](https://cve.now/CVE-2019-18179.md): An issue was discovered in Open Ticket Request System (OTRS) 7.0.x through 7.0.12, and Community Edition 5.0.x through 5.0.38 and 6.0.x thro (CVSS 3.5)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/daily/2020-01-06
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.